Security

(public)

User Story

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36
Firefox for Android
Steps to reproduce:
Hi there it seems Firefox IOS has the same CORS flaws as Webkit/Safari does rendering WebVR/WebGL useless.
It has been great pain to try and get Safari and IOS working with WebGL/WebVR with CDN hosted videos which is the standard way to deliver video.
The Webkit ticket for just this is here
https://bugs.webkit.org/show_bug.cgi?id=125157#c29
It would be really good if Firefox on IOS at least provides CORS support so WebGL actually works on IOS with cross domain video without needing proxy work arounds that will never scale.
It will take too long for Webkit to fix this and finally get released in IOS because lack of intervention from Apple.
An example of the problem is here using raw WebGL functions not three.js
https://jsfiddle.net/7t77rz6L/11/
I've yet to even check if Firefox can allow inline video playback. That is a deal break for WebGL to work on Iphone also. Non inline video will completely hide the WebGL canvas rendering WebVR useless.
Actual results:
CORS security errors no doubt. I can't see anything because Firefox IOS lacks remote debugging !
Expected results:
An example of an integrated toggling solution for proxy video playback is here. It will detect there is no CORS support and display a button to toggle to the proxied video
https://flowplayer.electroteque.org/vr360/fp6
It should hopefully not need to do that.

I forgot to mention as far as WebVR support goes on mobile. Android Firefox nightly is the ONLY browser with full support right now as they just only fixed orientation api bugs there and waiting for a full release. Android Chrome Dev has WebGL rendering bugs and broken. IOS and Safari is fully broken for VR.

Confirming Apple's disabling mechanisms force video into a native player for Firefox also, just tested it. Intentional sabotage from the looks of it on their part.
If there is a way to get both CORS working as for some reason CORs is fully functional on any Firefox browser apart from IOS and to force inline video playback that will make Firefox useful for VR on IOS. Right now IOS is useless.
VR is exploding right now and I believe it will expose Apple's flaws.
If the Firefox issues are related to and reliant on Webkit CORS support for WebGL then there might be problems sadly.

Thanks for all the investigation Daniel! Unfortunately we are unable to ship a patched version of WebKit inside Firefox for iOS so we'll need to wait for Apple to address these bugs as part of their OS releases :( Best thing we could do is submit patches to WebKit for the next OS release.